securenow 7.6.1 → 7.6.3

package/app-config.js

@@ -164,10 +164,84 @@ function readJsonSafe(filepath) {
   }
 }
 
+function fileIfReadable(filepath) {
+  if (!filepath) return null;
+  try {
+    return fs.existsSync(filepath) && fs.statSync(filepath).isFile() ? filepath : null;
+  } catch {
+    return null;
+  }
+}
+
+function findUpFile(startDir, relativePath) {
+  if (!startDir) return null;
+  let dir;
+  try {
+    dir = path.resolve(startDir);
+  } catch {
+    return null;
+  }
+
+  while (true) {
+    const found = fileIfReadable(path.join(dir, relativePath));
+    if (found) return found;
+
+    const parent = path.dirname(dir);
+    if (!parent || parent === dir) return null;
+    dir = parent;
+  }
+}
+
+function uniq(values) {
+  const seen = new Set();
+  const out = [];
+  for (const value of values) {
+    if (!value || seen.has(value)) continue;
+    seen.add(value);
+    out.push(value);
+  }
+  return out;
+}
+
+function resolveLocalCredentialsFile() {
+  const starts = [];
+  try {
+    if (typeof process !== 'undefined' && process.cwd) starts.push(process.cwd());
+  } catch {}
+
+  if (process.env.INIT_CWD) starts.push(process.env.INIT_CWD);
+  if (process.argv && process.argv[1]) starts.push(path.dirname(process.argv[1]));
+  if (require.main && require.main.filename) starts.push(path.dirname(require.main.filename));
+
+  for (const start of uniq(starts)) {
+    const found = findUpFile(start, path.join('.securenow', 'credentials.json'));
+    if (found) return found;
+  }
+
+  return null;
+}
+
+function resolvePackageJsonFile() {
+  const starts = [];
+  try {
+    if (typeof process !== 'undefined' && process.cwd) starts.push(process.cwd());
+  } catch {}
+
+  if (process.env.INIT_CWD) starts.push(process.env.INIT_CWD);
+  if (process.argv && process.argv[1]) starts.push(path.dirname(process.argv[1]));
+  if (require.main && require.main.filename) starts.push(path.dirname(require.main.filename));
+
+  for (const start of uniq(starts)) {
+    const found = findUpFile(start, 'package.json');
+    if (found) return found;
+  }
+
+  return null;
+}
+
 function loadLocalCredentials() {
   try {
-    const cwd = typeof process !== 'undefined' && process.cwd ? process.cwd() : '.';
-    return withCredentialDefaults(readJsonSafe(path.join(cwd, '.securenow', 'credentials.json')));
+    return withCredentialDefaults(readJsonSafe(resolveLocalCredentialsFile()));
   } catch {
     return null;
   }
@@ -183,8 +257,7 @@ function loadGlobalCredentials() {
 
 function loadCredentials() {
   try {
-    const cwd = typeof process !== 'undefined' && process.cwd ? process.cwd() : '.';
-    const local = readJsonSafe(path.join(cwd, '.securenow', 'credentials.json'));
+    const local = readJsonSafe(resolveLocalCredentialsFile());
     const global = readJsonSafe(path.join(os.homedir(), '.securenow', 'credentials.json'));
     return withCredentialDefaults(mergeCredentials(global, local));
   } catch {
@@ -194,8 +267,7 @@ function loadCredentials() {
 
 function loadPackageJsonName() {
   try {
-    const cwd = typeof process !== 'undefined' && process.cwd ? process.cwd() : '.';
-    const pkg = readJsonSafe(path.join(cwd, 'package.json'));
+    const pkg = readJsonSafe(resolvePackageJsonFile());
     if (pkg && typeof pkg.name === 'string' && pkg.name.trim()) {
       return pkg.name.trim().replace(/^@[^/]+\//, '');
     }

package/cli/init.js

@@ -114,7 +114,7 @@ async function initNextJs(dir, project, flags) {
   const existing = findInstrumentationFile(dir);
   if (existing) {
     ui.info(`instrumentation file already exists: ${path.relative(dir, existing)}`);
-    printAgentPrompt('instrumentation', path.basename(existing), nextMajor(project));
+    printAgentPrompt('instrumentation', path.basename(existing), nextMajor(project), project);
   } else {
     const filePath = path.join(dir, `instrumentation.${ext}`);
     fs.writeFileSync(filePath, INSTRUMENTATION, 'utf8');
@@ -130,7 +130,7 @@ async function initNextJs(dir, project, flags) {
       ui.success(`Updated ${path.basename(configPath)} with SecureNow server externalization`);
     } else {
       ui.warn(`Could not safely edit ${path.basename(configPath)} automatically.`);
-      printAgentPrompt('next-config', path.basename(configPath), nextMajor(project));
+      printAgentPrompt('next-config', path.basename(configPath), nextMajor(project), project);
     }
   } else {
     const newConfigPath = path.join(dir, 'next.config.mjs');
@@ -180,12 +180,34 @@ function patchNextConfig(configPath, major) {
   return 'manual';
 }
 
-function printAgentPrompt(kind, filename, major) {
+function scriptCommand(project, name) {
+  return project && project.pkg && project.pkg.scripts && project.pkg.scripts[name]
+    ? `npm run ${name}`
+    : null;
+}
+
+function availableVerificationCommands(project) {
+  const commands = [
+    scriptCommand(project, 'build'),
+    scriptCommand(project, 'test'),
+    scriptCommand(project, 'lint'),
+    scriptCommand(project, 'dev'),
+    project && project.pkg && project.pkg.scripts && project.pkg.scripts.start ? 'npm start' : null,
+  ].filter(Boolean);
+
+  return commands.length ? commands.join(', ') : null;
+}
+
+function printAgentPrompt(kind, filename, major, project) {
+  const commands = availableVerificationCommands(project);
   console.log('');
   ui.heading('Codex/Claude prompt');
   console.log([
     'Set up SecureNow in this existing Next.js project without using .env files.',
     'Use .securenow/credentials.json for local and production configuration; do not add .env files.',
+    commands
+      ? `Use the project scripts for verification when appropriate: ${commands}. Ask before starting long-running dev/start servers, and ask which command to use if these scripts are not the right customer workflow.`
+      : 'Ask the customer which command starts, builds, and tests this app because package.json does not expose an obvious script.',
     kind === 'instrumentation'
       ? `Merge this into ${filename}: in register(), return unless process.env.NEXT_RUNTIME === "nodejs"; then dynamically import "securenow/nextjs" and "securenow/nextjs-auto-capture" with /* webpackIgnore: true */ so Next does not bundle OpenTelemetry internals. Preserve all existing instrumentation.`
       : null,
@@ -195,7 +217,8 @@ function printAgentPrompt(kind, filename, major) {
     kind === 'next-config' && major < 15
       ? `Update ${filename} while preserving existing config: enable experimental.instrumentationHook and add securenow to experimental.serverComponentsExternalPackages.`
       : null,
-    'Verify with: npx securenow env, npx securenow test-span, npx securenow status, and the project build command.',
+    'Verify with: npx securenow env, npx securenow test-span, npx securenow status, plus the selected build/test command when available.',
+    'Only smoke-test an HTTP URL when the user provides a local or production URL, the running app prints one, or project config clearly defines one. Do not invent localhost ports or production domains; ask for the URL and skip URL probes if none is available.',
   ].filter(Boolean).join('\n'));
   console.log('');
 }

package/mcp/catalog.js

@@ -24,7 +24,10 @@ Safety rules:
 - Preserve existing middleware, proxy, instrumentation, Docker, PM2, and start scripts.
 
 Runbook:
-1. Identify the project root, package manager, framework, start/build/test scripts, process manager files, Docker files, and existing middleware/proxy/instrumentation.
+1. Identify the project root, package manager, framework, start/build/test scripts, process manager files, Docker files, and existing middleware/proxy/instrumentation.
+   - Use the repo's own scripts for verification. If the correct dev/start/build/test command is missing or ambiguous, ask the customer which command to use.
+   - Ask before starting long-running dev/start servers. Build/test/lint commands can be run when they are standard project scripts and safe for the current task.
+   - Do not invent HTTP URLs. Only probe a local or production URL when the customer provides one, the running app prints one, or project/deploy config clearly defines one.
 2. Install or upgrade SecureNow with the detected package manager, using securenow@latest. Verify the actual installed version with:
    node -p "require('./node_modules/securenow/package.json').version"
    npx securenow version
@@ -60,14 +63,16 @@ Runbook:
    - Run npx securenow firewall apps and npx securenow firewall status.
    - Confirm the selected app is present, firewallEnabled is true, and the SecureNow IPDB confidence threshold is visible.
    - If firewallEnabled is false, run the documented per-app enable command, for example npx securenow firewall enable --app <appKey>, then verify again.
-10. End-to-end proof:
-   - Run npx securenow doctor.
+10. End-to-end proof:
+   - Run npx securenow doctor.
    - Run npx securenow env and confirm loggingEnabled, captureBody, captureMultipart, and firewallEnabled resolve to true or 1 from credentials/defaults, unless I explicitly requested firewall-only.
-   - If available and not in firewall-only mode, send telemetry:
-     npx securenow test-span securenow.onboarding
-     npx securenow log send "SecureNow onboarding test" --level info
-   - Run the repo build/test command if available.
-   - For MCP-capable clients, optionally smoke-test npx securenow mcp with the securenow_auth_status tool.
+   - If available and not in firewall-only mode, send telemetry:
+     npx securenow test-span securenow.onboarding
+     npx securenow log send "SecureNow onboarding test" --level info
+   - Run the repo build/test/lint command when available. If multiple scripts look plausible or no script exists, ask the customer for the intended command instead of guessing.
+   - If a local app URL is available, make one simple GET request to a real route to generate request telemetry, then check npx securenow status and traces for the selected environment. If no local URL is available, say that URL smoke testing was skipped.
+   - If a production URL is provided or clearly discoverable, make one safe GET request to production and check npx securenow status/traces with --env production. If no production URL is available, do not fabricate one; ask for it or skip production URL smoke testing.
+   - For MCP-capable clients, optionally smoke-test npx securenow mcp with the securenow_auth_status tool.
 
 Final response:
 - List every changed file.
@@ -670,6 +675,11 @@ const PROMPTS = [
     description: 'Generic framework setup prompt for SecureNow tracing, logs, body capture, multipart, and firewall defaults.',
     arguments: [
       { name: 'projectRoot', description: 'Project root to configure.', required: false },
+      { name: 'startCommand', description: 'Optional customer-approved command to start the app.', required: false },
+      { name: 'buildCommand', description: 'Optional customer-approved build command.', required: false },
+      { name: 'testCommand', description: 'Optional customer-approved test command.', required: false },
+      { name: 'localUrl', description: 'Optional local URL to smoke-test after the app is running.', required: false },
+      { name: 'productionUrl', description: 'Optional production URL to smoke-test with --env production.', required: false },
     ],
   },
   {
@@ -701,6 +711,11 @@ function promptMessages(name, args = {}) {
           type: 'text',
           text: [
             args.projectRoot ? `Project root: ${args.projectRoot}` : null,
+            args.startCommand ? `Customer-approved start command: ${args.startCommand}` : null,
+            args.buildCommand ? `Customer-approved build command: ${args.buildCommand}` : null,
+            args.testCommand ? `Customer-approved test command: ${args.testCommand}` : null,
+            args.localUrl ? `Local URL for smoke testing: ${args.localUrl}` : null,
+            args.productionUrl ? `Production URL for smoke testing: ${args.productionUrl}` : null,
             UNIVERSAL_SECURENOW_SETUP_PROMPT,
           ].filter(Boolean).join('\n\n'),
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "7.6.1",
+  "version": "7.6.3",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
   "main": "register.js",